{"id":"CVE-2026-88340","title":"An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files","summary":"An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_…","severity":"none","published":"2026-09-22","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:17:10.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88340","references":[{"url":"https://github.com/VirusTotal/yara/issues/2239","label":"cve@mitre.org"},{"url":"https://github.com/VirusTotal/yara/pull/2244","label":"cve@mitre.org"},{"url":"https://github.com/VirusTotal/yara/pull/2244/changes/8d7bef643ee5fa2381e235bcedf80170a6b00d3b","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-22T20:10:15.098Z","epss":0.00206,"epssPercentile":0.11055,"slug":"CVE-2026-88340","body":"## Overview\n\nAn invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_rules_destroy() or wild pointer access in yr_object_create(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}